bff-entry-points
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a 'deny-by-default' architectural pattern for HTTP entry points, requiring explicit access classification (public, protected-read, protected-browser-mutation, or protected-upgrade) for all routes, which prevents unintentional exposure of endpoints.
- [SAFE]: It mandates robust defenses against common web vulnerabilities, including session-bound CSRF tokens, strict Origin and Fetch Metadata checks, and secure cookie profiles using the __Host- prefix and SameSite=Strict attribute.
- [SAFE]: The framework enforces a clear separation between authentication (handled at the adapter level) and authorization (handled as application policy), using provider-free principals to ensure domain logic remains decoupled from specific identity providers.
- [SAFE]: Specific security considerations are provided for realtime communication channels, ensuring that SSE streams and WebSocket upgrades are subject to the same rigorous authorization and session validation as standard HTTP requests.
- [SAFE]: Includes safe return-path validation logic (toSafeReturnPath) to mitigate open-redirect vulnerabilities by rejecting absolute URLs and protocol-relative targets.
Audit Metadata